Headline

Head of Security Engineering @Zepto | Review Board OWASP AppSec Days Singapore and BSides Vizag

About

Building and scaling security for one of India’s fastest-growing platforms operating at high velocity and scale. Over 10+ years, I've been building 0→1 security for high-growth startups. I've stood up security functions across Zepto, Slice, Spice Money, and Boutiqaat — spanning quick commerce, fintech, and MENA e-commerce. I operate as both a leader and a builder: architecting and shipping flagship systems while developing the engineers who own them. My focus sits at the intersection of cloud security, platform engineering, application security and developer velocity. I'm currently building Optimus, an AI-native security platform that automates and orchestrates the entire secure SDLC across the org. Less compliance theater, more measurable risk reduction in production.

Location

Greater Bengaluru Area

AI stack

codex

opencode

claudecode

Work experience

Associate Director, Security Engineering at Zepto, Apr 2026 - Present · 5 mos, Three roles in, and I'm still building. Now leading the full cybersecurity function — AppSec, Cloud Security, Infrastructure Security, and Incident Response as Zepto moves toward the public markets. Optimus, the AI-native security platform I architected from scratch, is now the backbone of how we detect, triage, and respond across 100+ microservices. The mission hasn't changed: keep Zepto secure at scale, without slowing the speed that makes us who we are.

Review Board Member at BSides Vizag, Aug 2025 - Present · 1 yr 1 mo, BSides is where the security community is honest with itself. Being on the review board means helping curate that conversation filtering for talks that challenge assumptions and push practitioners to think differently.

Review Board Member at OWASP AppSec Days Singapore, Jun 2025 - Present · 1 yr 3 mos, Helping shape the AppSec conversation in APAC. As a review board member, I evaluate talk submissions to ensure the conference surfaces work that actually moves the needle for practitioners; not just theory.

Security Engineering Manager at Zepto, Oct 2024 - Present · 1 yr 11 mos, Scaled what I built — grew from solo hire to leading a 9-engineer team, while staying the hands-on architect across every major security domain. This wasn't a manager role that drifted from the tools. I was in the code, in the incidents, and in the architecture the whole time. - AI & Agentic Security: Architected Optimus — multi-agent security platform built on Claude tool-use APIs and Bedrock embeddings — and set internal policy on third-party AI agents, MCP servers, and agentic system security across engineering - SBOM & Supply Chain: Built real-time SBOM graph across 250+ microservices with <15 min MTTD on newly disclosed CVEs - Incident Response: Owned end-to-end IR across all security domains — from supply chain compromises to live DDoS events; defended multiple and frequent DDoS attacks with zero downtime - WAF & Infrastructure: Deployed behavior-based adaptive rate limiting across AWS WAF, Cloudflare, and Shield Advanced; reduced inventory scraping 95% and saved $1M+ annually - Application Security: Shipped AI-assisted threat modeling microservice, embedded security rules into Cursor/Claude Code/Copilot, and stood up pre-commit enforcement across all engineering teams - Cloud Security & CSPM: Unified CSPM across AWS via Wiz, PingSafe, and Prisma Cloud; drove hardcoded secrets to zero and secured 400+ public subdomains - DLP & Data Governance: Led PII remediation across ~2,000 Data Bridge tables; ran Google Workspace DLP audit surfacing significant external exposure across the org - Cut security incidents 90% and delivered PCI DSS certification without slowing Zepto's release velocity

Lead Security Engineer at Zepto, Feb 2024 - Oct 2024 · 9 mos, Joined as Zepto's first security hire with a blank slate and a mandate: build it. No team, no program, no playbook — just the pace of a platform growing faster than almost anything in Indian commerce. Owned the entire security surface solo — AppSec, cloud posture, infrastructure hardening, and incident response Began architecting Optimus from scratch — not because anyone asked, but because I could see what we'd need at scale Stood up CSPM on AWS, secure SDLC foundations, and the first automated security gates in CI/CD Laid the foundation that enabled the team and program to scale from here

Lead Security Engineer at slice, Apr 2023 - Feb 2024 · 11 mos, Bengaluru, Karnataka, India, Grew into the lead role as the security program matured — took on full ownership of the function, the team, and regulatory delivery. Delivered RBI and PCI DSS compliance across UPI payments, PPI wallet, and B2C lending without slowing product rollout Ran penetration testing across mobile apps, payment gateways, and AWS infrastructure Built and ran CTF events for developers — because security culture sticks better with a scoreboard than a policy doc Left with a self-sufficient team and a program that could run without me

Senior Security Engineer at slice, Apr 2022 - Apr 2023 · 1 yr 1 mo, Bengaluru, Karnataka, India, First founding security hire at an RBI-regulated fintech. Walked in with no program, no team, and products under live regulatory scrutiny. Built the security function from zero — processes, tooling, and team hiring Owned API visibility, discovery, and security across payment and lending surfaces Stood up CSPM with continuous monitoring and automated security regression on AWS Introduced security awareness through developer sessions and hands-on CTF events

Senior Security Engineer at Boutiqaat, Jun 2021 - Apr 2022 · 11 mos, Gurugram, Haryana, India, My first step outside India. Boutiqaat was one of the largest influencer-driven beauty and fashion e-commerce platforms in the MENA region, Kuwait-headquartered, valued at $500M+ and scaling hard across the Gulf. A very different threat landscape from Indian fintech. This stint sharpened two things for me specifically: incident response and WAF. Got deep into Cloudflare managing live incidents and writing custom rules against attack patterns specific to MENA e-commerce. Ran web and mobile penetration testing, hardened cloud and SaaS infrastructure on AWS, embedded security into CI/CD pipelines via GitLab and Jenkins, and rolled out Forcepoint DLP. Short stint, but it broadened my lens significantly. Came back to India with a more global view of how security programs need to adapt to the market they are protecting.

Information Security Engineer at Boutiqaat, Jun 2021 - Apr 2022 · 11 mos

Education

Bachelor of Technology - BTech, Electronics and Communications Engineering, Kurukshetra university

Profile highlights

What I'm currently working on: I am currently scaling our security infrastructure to match Zepto's rapid growth. My focus is on hardening our cloud-native environment through advanced DevSecOps integration and automated zero-trust protocols.

what i've built with AI: I automated our threat detection pipelines using AI-driven anomaly detection to secure high-frequency commerce traffic. This integration allows my team to identify complex attack patterns in real-time, effectively scaling our defense alongside Zepto's rapid growth.

Public links

github: https://github.com/emgaurav